Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9c079b8ce8bf8e0394149eb39c78b04285644bcc to < 7eae011829f94a76470ec76f016805f508437755affected9c079b8ce8bf8e0394149eb39c78b04285644bcc to < 0634d50e8b398c25bd07c96b048e484d22688c26affected9c079b8ce8bf8e0394149eb39c78b04285644bcc to < e479240a1e076ba1104236331abd62400bf1d495affected9c079b8ce8bf8e0394149eb39c78b04285644bcc to < 6b1eb0b63cc153e1c0cb5ab8350950119be11947affected9c079b8ce8bf8e0394149eb39c78b04285644bcc to < 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68dbaffected
Linux Linux
Default version status: affected
4.20affected0 to < 4.20unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755 ↗
- https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26 ↗
- https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495 ↗
- https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947 ↗
- https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db ↗